topic Re: double indexing, does it count towards your license limit in Getting Data In

double indexing, does it count towards your license limit

riggas01 — Mon, 11 Dec 2017 23:25:08 GMT

if i send all syslog data to one splunk enterprise instance to be indexed and then it is forwarded onto another splunk enterprise instance.

Is the second splunk instance smart enough to know this data has already been indexed and doesnt count towards your daily license quota?

Thanks

Re: double indexing, does it count towards your license limit

micahkemp — Tue, 12 Dec 2017 02:12:11 GMT

It will absolutely hit your index volume a second time, assuming you are forwarding via syslog or splunk output.

You can make use of summary indexing or collect to search and index the results of said search, which won't hit your license cost again, but you don't want to do this for large amounts of data as a means to have two copies of all your data.

Re: double indexing, does it count towards your license limit

adonio — Tue, 12 Dec 2017 02:14:49 GMT

short answer, yes
there are many words on this topic here so here are couple of links that elaborate on the topic and shows ways around it.
https://answers.splunk.com/answers/103186/does-data-indexed-and-forwarded-from-a-heavy-forwarder-count-against-the-splunk-data-license.html
https://answers.splunk.com/answers/230480/indexing-data-and-forward-to-another-indexer.html
https://answers.splunk.com/answers/70017/heavy-forwarder-costs-and-licenses.html

hope it helps